1584fe5cf3b14c738ab0e5a3b39c0f0f4c2f5bcd9cd2c898d899c967fb9c1461

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 06:43

Target

8e7aacd9669eb2c72dc6db9fd6af3b70.dll
Size

41KB
MD5

8e7aacd9669eb2c72dc6db9fd6af3b70
SHA1

5d972f65e9f31cf39afc9d032136943ac39b92f0
SHA256

1584fe5cf3b14c738ab0e5a3b39c0f0f4c2f5bcd9cd2c898d899c967fb9c1461
SHA512

16c695d2f5a345a29cf913a23fedad351eeaaab0935a776566d93f21c891fb3164cd95a61fe48184b8bf51cb8b6d2aaff07e2a2519b343bc2e5534c38d4d477a
SSDEEP

768:rGu8NTJ5NLiNx+JABKN8WKJg7PBptwbWcZj3ko53RhY:yu8NN5NGNxmAIN8WKJgVrwtZf3RhY

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\espter.sys	rundll32.exe
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2012	2240	rundll32.exe	28
PID 2240 wrote to memory of 2012	2240	rundll32.exe	28
PID 2240 wrote to memory of 2012	2240	rundll32.exe	28
PID 2240 wrote to memory of 2012	2240	rundll32.exe	28
PID 2240 wrote to memory of 2012	2240	rundll32.exe	28
PID 2240 wrote to memory of 2012	2240	rundll32.exe	28
PID 2240 wrote to memory of 2012	2240	rundll32.exe	28
PID 2012 wrote to memory of 1252	2012	rundll32.exe	9

memory/1252-3-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download